eIDAS, age assurance and parental consent
European digital identity provides trusted facts. Valvur’s integration layer connects those facts to the checks, parental decisions and controls a digital service needs.
The missing connection between proof and participation
A game may need to know whether a player meets an age threshold. A social platform may need a guardian to create a supervised account. An AI service may need permission for a particular feature. Each decision combines several inputs: the service’s rules, the relevant age fact, parental responsibility and the permission for the requested action.
Valvur is building the layer that brings these inputs together through a common API and SDK model. Games, platforms and AI providers can connect age assurance and parental permissions to their own controls without assembling a separate family experience around every proof provider.
What eIDAS contributes
The European Digital Identity Framework provides the legal and technical basis for EUDI Wallets and electronic attestations of attributes. An attribute can establish a specific fact without requiring a service to collect a full identity document. Selective disclosure reduces what is shared; the KIDS proposal adds its own strict age-assurance privacy requirements.
Under KIDS Article 29, the age-verification route for Article 6 uses certified third-party EU solutions and the relevant trust lists. A wallet certified under eIDAS is treated as certified for that purpose only when it also meets the EU Age Verification Scheme. Other specified uses, such as certain safety defaults and app-store checks, have a separate route under Articles 27–29.
Four inputs, four different questions
| Input | Question it answers | How it affects access |
|---|---|---|
| Age assurance | Does this person meet the relevant threshold? | Selects the age-appropriate route without making a name or full date of birth the default disclosure. |
| Parental responsibility | Is this adult authorised to act for this child? | Establishes who can make guardian decisions. An adult identity check alone does not establish this relationship. |
| Parental permission | What does the guardian allow for this service and action? | Defines allowed features, contacts, time settings or sensitive actions within the limits of law. |
| Service policy | Is the requested action allowed under the applicable rules? | Combines mandatory protections with the family’s choices and returns the controls the service must apply. |
One integration from check to control
| Stage | Valvur layer | Result for the game or platform |
|---|---|---|
| Connect | Adapters connect eligible wallet, age-assurance and parental-authority routes. | A consistent integration model across different trust sources. |
| Check | The flow evaluates the required threshold, source eligibility and authority for the requested action. | The service receives the relevant outcome rather than an unnecessary identity dossier. |
| Ask | The guardian sees a clear request tied to a service, purpose and feature. | A specific decision replaces an ambiguous blanket approval. |
| Apply | The permission is bound to the action and passed to the provider’s enforcement controls. | Contacts, access and settings reflect the family’s decision and mandatory rules. |
| Update | Changes, expiry and withdrawal are communicated to the participating service. | Permissions can change as the child grows or circumstances change. |
Parents decide what, how and when
Valvur’s consent system is designed to give parents meaningful choices within the child’s lawful, age-appropriate access. A guardian can approve a service without enabling every feature, allow one contact without opening messages to everyone, or authorise one purchase without creating an unlimited spending permission.
Permissions can be specific to a service, feature, action, time period or spending limit. The family interface explains what is being allowed, what information is involved and how to change the decision. Children can see the controls that apply to them, with increasing agency as they grow.
Mandatory protections remain in force. Parental approval cannot waive a statutory prohibition. Permission to use a feature is also distinct from GDPR consent to process personal data: each processing purpose needs its own lawful basis and any applicable consent conditions.
Privacy is part of the connection
- Minimum disclosure: request the age or authority fact needed for the action, rather than a copy of an identity document.
- Separate records: keep age-assurance processing distinct from conversations, behavioural analysis and unrelated service data.
- Scoped permissions: use service-specific references and permissions instead of a universal child identifier.
- Purpose limits: a safety signal is not an input for advertising or an unrelated recommendation profile.
- Proportionate evidence: retain only lawful operational records needed to explain and manage the permission; wallet-intermediary rules restrict storage of transaction content.
- Family choice: EUDI Wallet use is voluntary. Accessible alternative proof routes remain part of an inclusive service.
An example: enabling chat in a game
A child asks to enable a chat feature. The game requests the relevant age and policy checks. If guardian permission is required, the flow establishes parental responsibility and presents the parent with the specific chat request. The parent can approve permitted contacts or keep chat restricted, within the applicable legal rules.
The game applies the result in its own backend and supported clients. A later withdrawal changes the permission rather than leaving the old approval active. The game does not need a copy of the parent’s identity document or the child’s complete history to implement this decision.
360° protection beyond the access decision
Age and consent provide the foundation for lawful participation. Valvur’s 360° approach connects that foundation to contextual protection, digital-resilience learning, parental guidance and trusted help. The purpose is to support children before, during and after a risky interaction.
For providers, this connects access controls with a wider safety experience. For families, it combines boundaries with understanding and support. For public programmes, it links digital identity infrastructure to practical protection and education.